leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
5fceef1f35
linux/fs
History
David Howells 7e6608724c nommu: fix shared mmap after truncate shrinkage problems 
Fix a problem in NOMMU mmap with ramfs whereby a shared mmap can happen
over the end of a truncation.  The problem is that
ramfs_nommu_check_mappings() checks that the reduced file size against the
VMA tree, but not the vm_region tree.

The following sequence of events can cause the problem:

	fd = open("/tmp/x", O_RDWR|O_TRUNC|O_CREAT, 0600);
	ftruncate(fd, 32 * 1024);
	a = mmap(NULL, 32 * 1024, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
	b = mmap(NULL, 16 * 1024, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
	munmap(a, 32 * 1024);
	ftruncate(fd, 16 * 1024);
	c = mmap(NULL, 32 * 1024, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);

Mapping 'a' creates a vm_region covering 32KB of the file.  Mapping 'b'
sees that the vm_region from 'a' is covering the region it wants and so
shares it, pinning it in memory.

Mapping 'a' then goes away and the file is truncated to the end of VMA
'b'.  However, the region allocated by 'a' is still in effect, and has
_not_ been reduced.

Mapping 'c' is then created, and because there's a vm_region covering the
desired region, get_unmapped_area() is _not_ called to repeat the check,
and the mapping is granted, even though the pages from the latter half of
the mapping have been discarded.

However:

	d = mmap(NULL, 16 * 1024, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);

Mapping 'd' should work, and should end up sharing the region allocated by
'a'.

To deal with this, we shrink the vm_region struct during the truncation,
lest do_mmap_pgoff() take it as licence to share the full region
automatically without calling the get_unmapped_area() file op again.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Greg Ungerer <gerg@snapgear.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-01-16 12:15:40 -08:00
..
9p 9p: fix build breakage introduced by FS-Cache 2009-12-01 07:35:11 -08:00
adfs adfs: remove redundant test on unsigned 2009-09-24 07:21:05 -07:00
affs
afs afs: remove manual O_SYNC handling 2009-12-10 15:02:50 +01:00
autofs
autofs4 autofs4: always use lookup for lookup 2009-12-16 07:19:58 -08:00
befs fs: Make unload_nls() NULL pointer safe 2009-09-24 07:47:42 -04:00
bfs
btrfs Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable 2009-12-17 16:01:03 -08:00
cachefiles Untangling ima mess, part 2: deal with counters 2009-12-16 12:16:47 -05:00
cifs Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 2009-12-31 15:17:26 -08:00
coda sysctl: Drop & in front of every proc_handler. 2009-11-18 08:37:40 -08:00
configfs
cramfs
debugfs debugfs: fix create mutex racy fops and private data 2009-12-11 11:24:53 -08:00
devpts devpts_get_tty() should validate inode 2009-12-11 15:18:05 -08:00
dlm Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/dlm 2009-12-10 09:33:59 -08:00
ecryptfs fsstack/ecryptfs: remove unused get_nlinks param to fsstack_copy_attr_all 2009-12-17 10:57:30 -05:00
efs
exofs exofs: simple_write_end does not mark_inode_dirty 2010-01-05 09:14:32 +02:00
exportfs nfs: new subdir Documentation/filesystems/nfs 2009-10-27 19:34:04 -04:00
ext2 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 2009-12-16 12:04:02 -08:00
ext3 ext3: Replace lock/unlock_super() with an explicit lock for resizing 2009-12-23 13:44:12 +01:00
ext4 ext4: Calculate metadata requirements more accurately 2010-01-01 02:41:30 -05:00
fat Merge git://git.kernel.org/pub/scm/linux/kernel/git/hirofumi/fatfs-2.6 2009-12-16 10:29:26 -08:00
freevxfs
fscache FS-Cache: Avoid maybe-used-uninitialised warning on variable 2009-12-16 07:20:13 -08:00
fuse fuse: reject O_DIRECT flag also in fuse_create 2009-11-27 16:37:13 +01:00
gfs2 GFS2: Use MAX_LFS_FILESIZE for meta inode size 2010-01-11 08:57:55 +00:00
hfs hfs: fix a potential buffer overflow 2009-12-15 08:53:10 -08:00
hfsplus hfsplus: refuse to mount volumes larger than 2TB 2009-10-29 07:39:27 -07:00
hostfs
hpfs hpfs: use bitmap_weight() 2009-12-16 07:20:06 -08:00
hppfs
hugetlbfs Untangling ima mess, part 1: alloc_file() 2009-12-16 12:16:47 -05:00
isofs Merge branch 'for-2.6.33' of git://linux-nfs.org/~bfields/linux 2009-12-16 10:43:34 -08:00
jbd jbd: jbd-debug and jbd2-debug should be writable 2009-12-23 13:44:13 +01:00
jbd2 jbd2: don't use __GFP_NOFAIL in journal_init_common() 2009-12-23 08:05:15 -05:00
jffs2 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 2009-12-16 12:04:02 -08:00
jfs jfs: Fix 32bit build warning 2009-12-22 12:27:35 -05:00
lockd Merge branch 'for-2.6.33' of git://linux-nfs.org/~bfields/linux 2009-12-16 10:43:34 -08:00
minix V3 minixfs: add missing directory type checking 2009-09-23 07:39:57 -07:00
ncpfs tree-wide: fix assorted typos all over the place 2009-12-04 15:39:55 +01:00
nfs nfs: fix oops in nfs_rename() 2010-01-06 18:48:26 -05:00
nfs_common
nfsd Merge branch 'for-2.6.33' of git://linux-nfs.org/~bfields/linux 2010-01-06 18:10:15 -08:00
nilfs2 nilfs2: Storage class should be before const qualifier 2009-12-25 13:01:50 +09:00
nls Merge git://git.kernel.org/pub/scm/linux/kernel/git/hirofumi/fatfs-2.6 2009-09-30 09:31:14 -07:00
notify inotify: only warn once for inotify problems 2010-01-15 14:49:23 -08:00
ntfs kill I_LOCK 2009-12-17 11:03:25 -05:00
ocfs2 ocfs2: Handle O_DIRECT when writing to a refcounted cluster. 2009-12-30 19:53:35 -08:00
omfs tree-wide: fix assorted typos all over the place 2009-12-04 15:39:55 +01:00
openpromfs
partitions partitions: read whole sector with EFI GPT header 2009-11-23 09:29:58 +01:00
proc smaps: fix wrong rss count 2010-01-11 09:34:07 -08:00
qnx4 qnx4: use hweight8 2009-12-16 07:20:18 -08:00
quota quota: Fix dquot_transfer for filesystems different from ext4 2010-01-11 13:06:41 +01:00
ramfs nommu: fix shared mmap after truncate shrinkage problems 2010-01-16 12:15:40 -08:00
reiserfs Merge branch 'reiserfs/kill-bkl' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/random-tracing 2010-01-08 14:03:55 -08:00
romfs ROMFS: fix length used with romfs_dev_strnlen() function 2009-10-11 11:33:56 -07:00
smbfs fs: Make unload_nls() NULL pointer safe 2009-09-24 07:47:42 -04:00
squashfs
sysfs sysfs: Add lockdep annotations for the sysfs active reference 2010-01-04 12:34:46 -08:00
sysv
ubifs lib: Introduce generic list_sort function 2010-01-12 21:02:00 -08:00
udf udf: Avoid IO in udf_clear_inode 2009-12-14 21:40:04 +01:00
ufs ufs: NFS support 2009-12-16 07:20:06 -08:00
xfs xfs: Ensure we force all busy extents in range to disk 2010-01-10 12:22:02 -06:00
aio.c aio: remove unused field 2009-12-16 07:20:13 -08:00
anon_inodes.c Sanitize f_flags helpers 2009-12-22 12:27:34 -05:00
attr.c truncate: new helpers 2009-09-24 08:41:47 -04:00
bad_inode.c
binfmt_aout.c mm: introduce coredump parameter structure 2009-12-17 15:45:31 -08:00
binfmt_elf_fdpic.c FDPIC: Respect PT_GNU_STACK exec protection markings when creating NOMMU stack 2010-01-06 18:16:02 -08:00
binfmt_elf.c mm: introduce coredump parameter structure 2009-12-17 15:45:31 -08:00
binfmt_em86.c
binfmt_flat.c mm: introduce coredump parameter structure 2009-12-17 15:45:31 -08:00
binfmt_misc.c
binfmt_script.c
binfmt_som.c mm: introduce coredump parameter structure 2009-12-17 15:45:31 -08:00
bio-integrity.c
bio.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2009-12-09 19:43:33 -08:00
block_dev.c Merge branch 'for-linus' into for-2.6.33 2009-11-03 21:14:39 +01:00
buffer.c Merge branch 'writeback' of git://git.kernel.dk/linux-2.6-block 2009-09-25 09:27:30 -07:00
char_dev.c fs/char_dev.c: remove useless loop 2009-09-24 07:21:03 -07:00
compat_binfmt_elf.c
compat_ioctl.c fs/compat_ioctl.c: fix build error when !BLOCK 2009-12-22 12:27:33 -05:00
compat.c compat.c: Remove dependence on nfsd private headers 2009-12-14 18:12:10 -05:00
dcache.c libfs: move EXPORT_SYMBOL for d_alloc_name 2009-12-16 12:16:48 -05:00
dcookies.c
direct-io.c dio: fix use-after-free 2009-12-17 04:52:13 -05:00
drop_caches.c sysctl: remove "struct file *" argument of ->proc_handler 2009-09-24 07:21:04 -07:00
eventfd.c anonfd: Allow making anon files read-only 2009-12-22 12:27:34 -05:00
eventpoll.c anonfd: Allow making anon files read-only 2009-12-22 12:27:34 -05:00
exec.c mm: introduce coredump parameter structure 2009-12-17 15:45:31 -08:00
fcntl.c fasync: split 'fasync_helper()' into separate add/remove functions 2009-12-16 10:05:29 -08:00
fifo.c
file_table.c alloc_file(): simplify handling of mnt_clone_write() errors 2009-12-22 12:27:33 -05:00
file.c headers: remove sched.h from interrupt.h 2009-10-11 11:20:58 -07:00
filesystems.c
fs_struct.c
fs-writeback.c writeback: add missing kernel-doc notation 2010-01-02 10:09:44 -08:00
generic_acl.c make generic_acl slightly more generic 2009-12-16 12:16:49 -05:00
inode.c kill I_LOCK 2009-12-17 11:03:25 -05:00
internal.h Fix f_flags/f_mode in case of lookup_instantiate_filp() from open(pathname, 3) 2009-12-22 12:27:34 -05:00
ioctl.c __generic_block_fiemap(): fix for files bigger than 4GB 2009-11-12 07:26:01 -08:00
ioprio.c
Kconfig Revert "task_struct: make journal_info conditional" 2009-12-17 13:23:24 -08:00
Kconfig.binfmt
libfs.c libfs: move EXPORT_SYMBOL for d_alloc_name 2009-12-16 12:16:48 -05:00
locks.c
Makefile
mbcache.c
mpage.c
namei.c generic_permission: MAY_OPEN is not write access 2009-12-30 12:35:44 -08:00
namespace.c Revert "fix mismerge with Trond's stuff (create_mnt_ns() export is gone now)" 2009-12-17 12:51:05 -08:00
nfsctl.c vfs: nfsctl.c un-used nfsd #includes 2009-12-14 18:12:11 -05:00
no-block.c
open.c Sanitize f_flags helpers 2009-12-22 12:27:34 -05:00
pipe.c fs: no games with DCACHE_UNHASHED 2009-12-17 10:51:40 -05:00
pnode.c
pnode.h
posix_acl.c
read_write.c sendfile(): check f_op.splice_write() rather than f_op.sendpage() 2009-11-04 09:09:52 +01:00
read_write.h
readdir.c
select.c headers: remove sched.h from poll.h 2009-10-04 15:05:10 -07:00
seq_file.c vfs: seq_file: add helpers for data filling 2009-09-24 07:47:35 -04:00
signalfd.c anonfd: Allow making anon files read-only 2009-12-22 12:27:34 -05:00
splice.c sendfile(): check f_op.splice_write() rather than f_op.sendpage() 2009-11-04 09:09:52 +01:00
stack.c VFS/fsstack: handle 32-bit smp + preempt + large files in fsstack_copy_inode_size 2009-12-17 10:58:17 -05:00
stat.c Add unlocked version of inode_add_bytes() function 2009-12-23 13:33:54 +01:00
super.c vfs: get_sb_single() - do not pass options twice 2009-12-23 11:23:43 -08:00
sync.c fold do_sync_file_range into sys_sync_file_range 2009-12-17 11:03:25 -05:00
timerfd.c anonfd: Allow making anon files read-only 2009-12-22 12:27:34 -05:00
utimes.c
xattr_acl.c VFS: Use GFP_NOFS in posix_acl_from_xattr() 2009-12-03 11:48:07 +00:00
xattr.c sanitize xattr handler prototypes 2009-12-16 12:16:49 -05:00